Kubernetes满⾜了在⽣产中运⾏的应⽤程序的⼀些常⻅需求，例如： Co-locating helper processes ，促进组合应⽤程序和保留”⼀个应⽤程序的每个容器“模型 Mounting storage systems Distributing secrets Checking application health Replicating application instances Using Namespace和DNS 当你创建 Service 时，会创建⼀个相应的 DNS entry 。此条⽬的形式为 ..svc.cluster.local ，这意味着如果容器只使⽤ ，则它将解析为Namespace本地的服务。 这对在 多个Namespace（例如Development、Staging以及Prod piserver⼀个 --runtime-config 选项来禁⽤StatefulSet。 给定Pod的存储必须由 PersistentVolume Provisioner 根据请求的 storage class 提供，或由管理员预先设置。 删除/缩容StatefulSet将不会删除与StatefulSet关联的Volume。这样做是为了确保数据安全性，这通常⽐⾃动清除 StatefulSet所有相关资源更有价值。

k8s把iptables规则设置完毕再在以下几个chain里放通所有流量，如果对防火墙 有自定义规则或对安全性要求较高场景无需配置以下这段，防火墙相关操作自 行按需处理！ # cat >> /etc/rc.d/rc.local <local: dataDir: /var/lib/etcd imageRepository: cof-lee.com:5443/k8s kind: ClusterConfigura�on kubernetesVersion: v1.19.4 networking: dnsDomain: cluster.local serviceSubnet: 10 {} dns: {} etcd: local: dataDir: /var/lib/etcd imageRepository: cof-lee.com:5443/k8s kind: ClusterConfigura�on kubernetesVersion: 1.28.2 networking: dnsDomain: cluster.local serviceSubnet: 10

"log-driver": "json-file", "log-opts": { "max-size": "100m" }, "storage-driver": "overlay2", "storage-opts": [ "overlay2.override_kernel_check=true" ] } systemctl restart com/google_containers controlPlaneEndpoint: "k8s-master:6443" networking: dnsDomain: cluster.local podSubnet: 10.98.0.0/16 serviceSubnet: 10.96.0.0/16 --- apiVersion: kubeproxy.config.k8s None type: ExternalName externalName: kubernetes-dashboard.kubernetes-dashboard.svc.cluster.local kubectl apply –f service.yaml kubectl apply –f service2default.yaml Step7: 创建 SSL 证书的

app-name:2019-0510-1033_dev 仓库域名+路径 空间名 应用名称 日期-时间戳 git版本库 镜像完整地址 registry.hz.local/huize ai-test ai-dc-web 20190510-1033 v20 registry.hz.local/huize/ai-test_ai-dc-web:20190510-1033_v20 k8s镜像构建过程 domain/path namespaces flannel node K8S-flanneld网络分析 node2 pod docker pod pod-gw- eth0 eth eth0 eth L2 local-network本地网络 docker内部子网 L3 k8s pod网络 flanneld控制 flanneld node1 pod docker pod eth eth0 eth L4 k8s-svc网络-LVS 由kube-proxy管理 core-dns 解析域名 访问过程 1.core-dns解析来集群内部域名kubernetes.cluster.svc.local; 2.流量达到ipvs-eth; 3.lvs负载均衡对流量进行轮寻，寻找目的pod下一跳; 4.流量达到node1,node2的eth0,经过内部路由进行传输; 5.内部路由到达docke

IP for external access • Interfaces with local iptables • Load-balance interface for Pods • Creates virtual IP for external access • Interfaces with local iptables The Kubernetes Runtime Components Architecture Storage vSphere Kubelet Datastore1 K8s Vol dataVol.vmdk K8s vSphere Cloud provider Kubernetes Worker (VM) Pod Tools, Libs, SW Redis DB K8s API vCenter Create Storage Class Create thin-disk Provisioner: vSphere Volume Diskformat: thin Name: volume-claim Storage class: thin-disk Accessmode: readwrite Storage: 2GB Podspec includes: Persistent volume claim Filesystem mount point RedisDB

encryption for etcd (local + remote) Local Encryption Provider KMS Encryption Provider Background: K8s Secrets • Encryption Keys stored on API Server • Secrets encrypted prior to storage in etcd • Secrets memory • Protecting the encryption / decryption of DEKs / Secrets • Introducing mutual (remote / local) attestations between entities Production Experience @ Ant Group KMS Plugin • Workflow • Encryption config KMS Plugin (cont.) • Gray release • extensions-webhook: /mutating-secret • Annotation: /storage-transform-disable= • Emergency management • High Availability guarantee • KMS • API server

，可以从集群的外部访问⼀个 NodePort 服务。 关联：选择服务要绑定的后端对象o。若不进⾏关联部署，则不会创建相关的 Endpoints 对象，您 可⾃⼰进⾏绑定。 外部流量策略：可选值为Local或Cluster。 说明 服务类型为NodePort时，才能设置外部流量策略。 端⼝映射：添加服务端⼝和容器端⼝，容器端⼝需要与后端的 Pod 中暴露的容器端⼝⼀致。 注解：为该服务添加⼀个注解（annotation）。 PROVISIONER AGE 4 wordpress-sc-001 cds/nas 30m sc.yaml 内容如下 1 apiVersion: storage.k8s.io/v1 2 kind: StorageClass 3 metadata: 4 name: wordpress-sc-001 5 provisioner: nas 15 spec: 16 accessModes: 17 - ReadWriteOnce 18 resources: 19 requests: 20 storage: 20Gi 21 storageClassName: wordpress-sc-001 22 --- 23 apiVersion: v1 24 kind: PersistentVolumeClaim

America December 13, 2018 2 Open Source Community Relations Engineer VMware Active in Kubernetes storage community since 2015. Chair of Kubernetes VMware SIG. GitHub: @cantbewong Application Platform Zones() interface #64021 vSphere Cloud Provider does not work when deployed across Zones with zone-local Storage #67703 24 Configuring VM affinity rules Quorum dictates design VM Fault Domain A VM VM VM Pro-active failure avoidance can also be engaged. Example loss of a system cooling fan, degraded storage, or can trigger automated evacuation before host failure. 26 Configuring HA restart priority Ensure

分布式，高可用 • 高性能，低延迟 • 线性扩容 海尔工业互联网 –微服务之监控日志 Node PrometheusServer（Pod） Retrieval Storage PromQL Local Storage Web UI（Pod） Grafana（Pod） API Push Gateway Jobs / Exporters Prometheus Server Short-lived

PD �������� TiKV ����(����� ����������)! tidb-volume- manager! • �� external-storage �� PV ���! • �� hostPath �� Local PV (StorageClass: pingcap- volume-provisioner)! CNUTCon TiDB ����!